ci(scorecard): adopt standards scorecard-reusable wrapper

[hyperpolymath]

Summary

Converts .github/workflows/scorecard.yml from a standalone OSSF Scorecard job into a thin wrapper around hyperpolymath/standards/.github/workflows/scorecard-reusable.yml, mirroring how governance.yml already delegates to the estate's reusable workflows. Scorecard was the remaining read-only check still carrying a per-repo copy.

This salvages the one genuinely useful idea from the now-closed, stale PR #30 — but done correctly on top of current main:

	stale PR #30	this PR
License header	⛔ relicensed to PMPL-1.0-or-later (reverts #33)	✅ keeps MPL-2.0
standards pin	5a93d9d (older)	✅ 861b5e9 — same commit governance.yml pins
Caller permissions	contents: read only → SARIF upload would fail	✅ grants security-events: write + id-token: write on the calling job
Base	~9 commits behind main, conflicting	✅ current main, clean
Scope	also deleted scorecard-enforcer.yml	✅ leaves it standalone (it owns the score-threshold gate + SECURITY.md / pinned-deps checks the reusable doesn't cover)

The triggers (branch_protection_rule, daily schedule, workflow_dispatch) and the estate concurrency guardrail are preserved, so runtime behaviour is unchanged. timeout-minutes is intentionally omitted — it isn't a permitted key on a reusable-calling job; the reusable owns its own timeouts.

Type of change

• 🔧 Build / CI / tooling

How has this been verified?

• Confirmed scorecard-reusable.yml exists in hyperpolymath/standards@861b5e9 and that its analysis job declares security-events: write + id-token: write (hence the matching grant on the caller).
• Parsed the workflow with yq: name, triggers, job permissions, and the uses: reference all resolve as intended.

Notes for reviewers

• Closes out the scorecard half of Claude/gallant shannon 82193p #30; the test-suite half of Claude/gallant shannon 82193p #30 was already on main (patch-equivalent to e49bdfd/e036fb7), so nothing else from it is needed.
• hypatia-scan.yml is not included here: despite its top-of-file "Thin wrapper…" comment, it is still the full standalone scanner on main. Converting it is a larger change (gitbot-fleet phase, SARIF converter, PR-comment + gating policy) — happy to do it as a separate PR if you want the estate fully consistent.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AHygjxRyU3WwmXEhA9KF5L

---

Generated by Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

🔍 Hypatia Security Scan

Findings: 42 issues detected

Severity	Count
🔴 Critical	0
🟠 High	32
🟡 Medium	10

View findings

[
  {
    "reason": "Belt.Array deprecated -- use Array (12 occurrences)",
    "type": "deprecated_api",
    "file": "/home/runner/work/empty-linter/empty-linter/src/core/TextTransform.res",
    "action": "module_replace",
    "rule_module": "migration_rules",
    "severity": "high"
  },
  {
    "reason": "Js.Array2 deprecated -- use Array (1 occurrences)",
    "type": "deprecated_api",
    "file": "/home/runner/work/empty-linter/empty-linter/src/core/TextTransform.res",
    "action": "search_replace",
    "rule_module": "migration_rules",
    "severity": "high"
  },
  {
    "reason": "Js.String2 deprecated -- use String (9 occurrences)",
    "type": "deprecated_api",
    "file": "/home/runner/work/empty-linter/empty-linter/src/core/TextTransform.res",
    "action": "search_replace",
    "rule_module": "migration_rules",
    "severity": "high"
  },
  {
    "reason": "Belt.Array deprecated -- use Array (11 occurrences)",
    "type": "deprecated_api",
    "file": "/home/runner/work/empty-linter/empty-linter/src/core/ByteDetector.res",
    "action": "module_replace",
    "rule_module": "migration_rules",
    "severity": "high"
  },
  {
    "reason": "Js.Array2 deprecated -- use Array (2 occurrences)",
    "type": "deprecated_api",
    "file": "/home/runner/work/empty-linter/empty-linter/src/core/ByteDetector.res",
    "action": "search_replace",
    "rule_module": "migration_rules",
    "severity": "high"
  },
  {
    "reason": "Js.String2 deprecated -- use String (25 occurrences)",
    "type": "deprecated_api",
    "file": "/home/runner/work/empty-linter/empty-linter/src/core/ByteDetector.res",
    "action": "search_replace",
    "rule_module": "migration_rules",
    "severity": "high"
  },
  {
    "reason": "Belt.Array deprecated -- use Array (2 occurrences)",
    "type": "deprecated_api",
    "file": "/home/runner/work/empty-linter/empty-linter/src/core/PathHandler.res",
    "action": "module_replace",
    "rule_module": "migration_rules",
    "severity": "high"
  },
  {
    "reason": "Js.String2 deprecated -- use String (13 occurrences)",
    "type": "deprecated_api",
    "file": "/home/runner/work/empty-linter/empty-linter/src/core/PathHandler.res",
    "action": "search_replace",
    "rule_module": "migration_rules",
    "severity": "high"
  },
  {
    "reason": "Belt.Array deprecated -- use Array (6 occurrences)",
    "type": "deprecated_api",
    "file": "/home/runner/work/empty-linter/empty-linter/src/bindings/Deno.res",
    "action": "module_replace",
    "rule_module": "migration_rules",
    "severity": "high"
  },
  {
    "reason": "Js.Array2 deprecated -- use Array (2 occurrences)",
    "type": "deprecated_api",
    "file": "/home/runner/work/empty-linter/empty-linter/src/bindings/Deno.res",
    "action": "search_replace",
    "rule_module": "migration_rules",
    "severity": "high"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence